I've heard the eval() function is vulnerable to SQLi.

Can I check for vulnerabilities by simply viewing the website source code?

  • Not the html generated server side and given to the client. If you got access tho the server side code (php/java/.net/asp) you could detect the SQLi vulnerabilities. That is a security code review. – bradbury9 Jul 26 '18 at 6:46

Depends what you mean by "source code".

If you use the "view source" function in a web browser, that's not sufficient. That shows you the client side code, while SQLi occurs on the server side.

If you examine the full source code that is running on the server, then yes, examining it can let you find SQLi issues. You can even find SQLI by decompiling executable files if a system is using ASP without source files on the server but fails to protect the compiled files from download.


The typical SQL injection attack can occur when the SQL command string is concatenated to include a user entry:

$sql = "SELECT * FROM users WHERE user_name = '".$user_name."'";

A malicious user could enter a user name like

my name'; DROP TABLE users; --

Guess what happens!

Better use prepared statements and parameterized queries.

  • SQLi can also occur inside SQL procedures if they build up SQL statement the same way (by concatenating things, even when it's not direct user entries) – Xenos Jul 26 '18 at 7:15

eval() allow you to evaluate code, so yo can have a code injection. Example: eval("echo 2;"); will print 2 in PHP.

In PHP you also have shell_exec() where you can execute shell commands.

You can check several types of injection here.

Looking to the website source code is a valid way to check for links to other pages and check what query parameters are used. You can also check forms.

Another way is to check Network tab, to view what information is sent and received by your browser. Try to take a look into Burp Suite, it will help you understand better how to intercept requests and tamper with them to check for some vulnerabilities.


Actually, if you have access to the back-end source then yes, you'll be able to identify SQLi, but in another case nope, I always do it manually, testing all input parameters, for example filling username and password with 'OR' 1=1 & etc... Finding out if SQL code is sanitizing post parameters.

  • I have seen html comments with actual server side code in them, and my rage was incredible. Anyway it is sooo rare it would hardly ever happen to you. – bradbury9 Jul 26 '18 at 6:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.